Competence

Plain-language summary

Knowing which jobs affect information security, deciding what competence each of them needs, making sure the people in them have it — by education, training or experience — closing gaps, and keeping the evidence.

What the clause is really asking

Competence is the skill to do a security-relevant job properly, and the clause covers far more than the security team. System administrators, developers, the HR officer who runs onboarding and offboarding, the procurement lead who signs supplier contracts, the incident response lead, internal auditors who audit the ISMS, and the Information Officer under POPIA all do work that affects information security performance. For each, you determine the competence needed, ensure the people have it on the basis of education, training or experience, take action where there is a gap (training, mentoring, hiring, reassignment, contracting in) and evaluate whether the action worked, and retain documented evidence. Awareness (7.3) is different and lighter: everyone needs awareness; only some roles need competence. Certificates from courses are one form of evidence; a record of relevant experience and a manager's evaluation is another. Qlause's own training certificates are written for this clause — they evidence competence, they do not accredit anyone.

What auditors look for

Auditors pick security-relevant roles and ask three questions: what competence does this role need, how do you know this person has it, and what did you do about the last gap? They look at the internal auditors in particular — an ISMS audited by people with no training in ISO 27001 or auditing is a standard finding — and at new-starter and role-change records. They check the effectiveness evaluation exists: training attended is not the same as competence gained. They will also ask who is competent to run the risk assessment and to assess technical controls.

Typical evidence

Competence requirements by role (a competence matrix or job descriptions with security competences); training records, certificates and experience summaries; gap analysis and training plan; effectiveness evaluations after training; internal-auditor competence records (ISO 27001 and auditing); records for contracted-in expertise.

How to comply — recommendations

Build a one-page competence matrix: security-relevant roles down the side, competences across the top, and for each cell the evidence held and the gap action. Start with six roles — ISMS lead, system administrators, developers, HR onboarding, procurement, internal auditors — and add the Information Officer. Close gaps with the cheapest effective route, and evaluate three months later by asking the manager a concrete question: can this person now do the thing? Keep the matrix beside the training records; it is the single document that answers the auditor's first question. Extend your ISO 9001 competence records if you have them.

Common nonconformities

Security-relevant roles not identified; no competence requirements defined for them; internal auditors without ISMS or audit training; training delivered but effectiveness never evaluated; no evidence of competence retained for key roles; competence of contracted expertise not checked; competence not reviewed when roles change.

Resources for this clause

• ArticleWhat ISO 27001 actually requires for security awareness and training — clauses 7.2 and 7.3, control A.6.3, and what the auditor tests on the floor
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free courseInternal Auditor coursePlanning, running and reporting internal audits, with a verifiable certificate.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.